Stay updated with the latest cybersecurity news! This daily roundup covers critical vulnerabilities under active exploitation, major data breaches, emerging ransomware campaigns, AI-related threats, hardware wallet incidents, supply-chain attacks, and attacks on critical infrastructure. These developments highlight the rapid pace of both nation-state and criminal activity in the current threat landscape.
1. N-able N-central Authentication Bypass Actively Exploited (CVE-2026-18577)
Published: 2026-08-03
Attackers are exploiting an authentication bypass (CVE-2026-18577) in N-able’s widely used N-central remote monitoring and management (RMM) platform. The flaw stems from an incomplete earlier patch and allows unauthenticated administrative (“god-mode”) access to N-central servers. Once inside, threat actors have abused the Take Control feature to reach managed endpoints and installed persistent Cloudflare tunnels. A limited number of customers have been impacted; N-able released hotfix 2026.3.1.7 and urges all users (cloud and on-premises) to upgrade immediately.
2. INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws
Published: 2026-08-03
INC Ransomware has become the leading threat actor weaponizing recently disclosed SonicWall Secure Mobile Access (SMA) 1000 series VPN vulnerabilities (CVE-2026-15409 and CVE-2026-15410). The flaws enable arbitrary command execution and full device takeover. Exploitation began as zero-days earlier in the year; the group has listed multiple new victims across the US, Australia, UAE, Colombia, Switzerland and elsewhere, with total claimed victims approaching 885. Patches were released in mid-July, but many appliances remain exposed.
3. PNLD Breach Exposes UK Police and Government Contact Details on Dark Web
Published: 2026-08-03
The UK’s Police National Legal Database (PNLD) confirmed a data security incident identified on 26 July 2026. Contact information (names, organisations and work email addresses) belonging to more than 100,000 police officers, staff, criminal justice professionals and government partners was compromised and published on the dark web by the ExfilSquad group. Approximately 21,000 public “Ask the Police” users were also affected. No passwords or confidential operational data appear to have been taken; investigations involving the National Crime Agency are ongoing.
4. Malware Can Hijack Google Passkey-Protected Accounts via Password Manager Flaws
Published: 2026-08-03
Unit 42 researchers detailed three attack techniques (“Pass-ta-key,” “Silver Pass-ta-key” and “Golden Pass-ta-key”) that allow malware running as a regular Windows user to hijack Google Password Manager synced passkeys. Attackers can obtain valid authentication assertions, install attacker-controlled verification keys, or extract the Security Domain Secret needed to decrypt private keys—all without any user interaction, fingerprint or PIN prompt appearing on the victim’s screen.
5. Coldcard Hardware Wallet Firmware Flaw Leads to ~$89M+ Bitcoin Theft
Published: 2026-08-03
A long-standing firmware bug in Coinkite’s Coldcard Bitcoin hardware wallets caused weak seed generation (falling back to a software PRNG instead of the hardware true random number generator). Attackers reconstructed private keys and drained more than 1,300 BTC (valued at roughly $89 million and climbing across multiple waves) from thousands of addresses, primarily between 30 July and early August. Affected users must generate entirely new seeds and move funds; simply updating firmware does not secure previously created wallets.
6. 18 Malicious npm Packages Deliver Cross-Platform RAT Targeting Alibaba Tool Users
Published: 2026-08-03
Researchers discovered a set of malicious npm packages that deliver a cross-platform remote access trojan (RAT) specifically aimed at users of Alibaba developer tools in Chinese-speaking environments. The packages impersonate legitimate libraries and use staged loaders to fetch and execute remote payloads as part of a targeted software supply-chain campaign.
7. US Water System Cyberattacks Expand to at Least Seven States; Iran Links Suspected
Published: 2026-08-03
Coordinated cyberattacks on water and wastewater systems that began in Minnesota (affecting more than 30 facilities) have expanded to at least six additional states. Attackers targeted internet-exposed programmable logic controllers (PLCs), changed passwords, and disrupted operations, leading to boil-water notices and manual control in some cases. CISA, FBI and other agencies have warned of a significant increase in such activity against the water sector and strongly recommend disconnecting exposed OT devices from the internet. Evidence points to Iran-affiliated actors consistent with earlier campaigns.
8. Critical Ruby on Rails Active Storage RCE Vulnerability (CVE-2026-66066) with Public PoC
Published: 2026-08-03
A critical remote code execution vulnerability in Ruby on Rails Active Storage (CVE-2026-66066) allows unauthenticated attackers to read arbitrary files and potentially achieve RCE. A public proof-of-concept and Metasploit module have been released, raising concerns especially for cloud-hosted applications. Immediate patching is strongly advised.
Read more (search “Rails Active Storage” or related coverage on major outlets)
Stay Vigilant
Cyber threats continue to evolve at high speed, blending ransomware, supply-chain compromises, AI-assisted operations, critical-infrastructure targeting and sophisticated credential/passkey attacks. Prioritise rapid patching of internet-facing systems (especially RMM platforms, VPN appliances and OT devices), monitor for unusual administrative activity, rotate credentials after any potential exposure, and maintain strong offline backups. Subscribe to reliable threat-intelligence feeds and consider continuous monitoring solutions for your environment. Stay safe online!